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Abstract. We propose a probabilistic network model, called asynchronous bounded 
expected delay (ABE), which requires a known bound on the expected message 
delay. In ABE networks all asynchronous executions are possible, but executions 
with extremely long delays are less probable. Thus, the ABE model captures 
asynchrony that occurs in sensor networks and ad-hoc networks. 
At the example of an election algorithm, we show that the minimal assumptions 
of ABE networks are sufficient for the development of efficient algorithms. For 
anonymous, unidirectional ABE rings of known size n we devise a probabilistic 
election algorithm having average message and time complexity 0(n). 



1 Introduction 

The two commonly used network models are synchronous and asynchronous. In syn- 
chronous network all nodes proceed simultaneously in global rounds. While this model 
allows for efficient algorithms, the assumptions are typically too strict for practical ap- 
plications. The (fully) asynchronous network model, on the other hand, requires only 
that every message will eventually be delivered. The assumptions of this model are 
generally too weak to study the time complexity of algorithms. 

For the development of practically usable, efficient algorithms we need to find a 
golden mean between synchronous and asynchronous networks. A possible approach 
is asynchronous bounded delay (ABD) networks [1,2], where a fixed bound on the 
message delivery time is assumed. Due to this assumption, ABD networks are generally 
closer to synchronous than to fully asynchronous networks. The ABD model is a nice 
theoretical framework, but the assumption of a bounded message delay is often hard to 
satisfy in real-life networks. 

We propose a probabilistic model, that we call asynchronous bounded expected de- 
lay (ABE) networks. The ABE network model requires a known bound on the expected 
message delay. Thus, we strengthen the asynchronous network model with a minimal 
requirement for analysing the time complexity of algorithms. 

We elaborate on the advantage of ABE over the ABD network model. A strong 
point in favour of the ABE network model is its probabilistic nature. A probabilistic 
treatment of the message delay is for example crucial to analyse protocols that employ 
a timeout mechanism like in the TCP/IP protocol. The assumption of the known bound 



on the expected message delay allows for deriving a lower bound on the probability 
that a message will arrive within a given time limit (before the timeout). In contrast, it 
is impossible to evaluate algorithms with timeout mechanism on the basis of the ABD 
network model. The only assumption of the ABD network model is a fixed bound on 
the message delay. If the timeout is greater or equal to this bound, then all messages 
will arrive in time, rendering the timeout mechanism useless. If the timeout is smaller 
than the bound on the message delay, it is impossible to estimate how many messages 
will arrive before the timeout (all messages could arrive after the timeout). 

Moreover, messages sent via a physical channel may get lost or corrupted, for ex- 
ample, due to material imperfections or signal inferences. Since message transmission 
is unreliable, all we can settle for is a probability p of successful transmission. To en- 
sure that a message arrives at its destination, it may need to be retransmitted (possibly 
multiple times) until the transmission has been successful. The number of necessary 
retransmissions for a message cannot be bounded: with probability (1 — p) k a message 
requires more than k retransmissions, and thus the message delay is unbounded. While 
the message delay cannot be bounded, from the probability p we can derive the average 
number of needed retransmissions and thereby the average message delay. In particular, 
the average number of transmissions is k avg — ^2^ =0 {k + 1) • (1 — p) k ■ p = i. As- 
suming that a successful transmission takes one time unit, the average message delay 
is | as well. Assuming that we know the exact value of p for physical channels may 
already be an unrealistic assumption. However, frequently a lower bound pi ow < p on p 
can be derived from material properties in combination with the maximum strength of 
inference signals in a given environment. Such a lower bound on p is sufficient to derive 
an upper bound on the expected message delay, and this suffices for ABE networks. 

Although the assumptions of ABE networks are minimal, it is possible to devise 
efficient algorithms. We demonstrate this on an example of an election algorithm for 
anonymous, unidirectional ABE rings having (average) linear time as well as message 
complexity. So its efficiency is comparable to the most optimal election algorithms 
known for anonymous, synchronous rings [3]. 

Election is the problem of determining a unique leader in a network, in the sense 
that the leader (process or node) knows that it has been elected and the other processes 
know that they have not been elected. This is a fundamental problem in distributed 
computing and has many applications. For example, it is an important tool for breaking 
symmetry in a distributed system. By choosing a process as the leader it is possible 
to execute centralised protocols in a decentralised environment. Election can also be 
used to recover from token loss for token-based protocols, by making the leader re- 
sponsible for generating a new token when the current one is lost. There exists a broad 
range of election algorithms; see e.g. the summary in [2,4]. These algorithms have dif- 
ferent message complexity in the worst and/or average case. Furthermore, they vary 
in communication mechanism (asynchronous vs. synchronous), process names (unique 
identities vs. anonymous), and network topology (e.g. ring, tree, complete graph). 

Classical (deterministic) election algorithms are [5-8] for asynchronous rings with 
worst-case message complexity 0(n log n), and [9] for synchronous unidirectional rings 
with worst-case message complexity 0(n). Without additional assumptions, Q(n log n) 
is the lower bound on the average message complexity for asynchronous rings [10, 1 1]. 
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In an anonymous network, processes do not carry an identity. As the number of 
processes in a network increases, it may become difficult to keep the identities of all 
processes distinct, or a network may accidentally assign the same identity to differ- 
ent processes. In some situations, transmitting identities may be too expensive (e.g., 
FireWire bus, cf. [12]). Since deterministic election is impossible in an anonymous net- 
work [13]; randomisation is used to break the symmetry. 

If the network size is known, it is possible to construct a randomised election algo- 
rithm that terminates with probability one, e.g. [14]. It exhibits infinite traces, but the 
probability that such an infinite trace is executed is zero. For unknown network size, 
the presence of an oracle for leader detection is required, e.g. [15]. In the absence of 
an oracle, there are several impossibility results for anonymous rings. No randomised 
algorithms can elect a leader in an anonymous ring if the ring size is known only within 
a factor of two [13]. Furthermore, algorithms for computing the ring size always have 
a positive probability of computing the wrong result [2]. Thus, there is no randomised 
algorithm that can elect a leader in an anonymous ring of unknown size. 

We study the problem of election in anonymous, asynchronous rings. For such rings, 
the best known election algorithms are [14, 16-18] with average message complex- 
ity 6>(n log n). Itai and Rodeh [3] have proposed an algorithm for synchronous uni- 
directional anonymous rings; its average message complexity is 0(n). The algorithm 
strongly depends on the notion of rounds, even though the idea of the activation pa- 
rameter in this algorithm is similar to ours. The algorithm proceeds multiple elections, 
each of which consist of exactly n rounds. Both central ideas of the algorithm crucially 
depend on synchronous networks: the synchronous sending of the messages in the be- 
ginning of the election as well determining the number of active nodes by counting the 
messages passed through in n rounds. Thus, the similarities between our algorithm and 
that of Itai-Rodeh are limited to the activation parameter, which is a very natural choice 
in probabilistic systems. Hence, the Itai-Rodeh algorithm cannot be adapted for ABE 
networks; however, our algorithm works in synchronous networks. 



Contribution and outline. The ABD model assumes that there is a fixed bound on 
message delay. In Sec. 2 we propose a probabilistic network model, called asynchronous 
bounded expected delay (ABE) networks, that allows for an unbounded message delay, 
and assumes a known bound on expected message delay. This model is closer to the 
fully asynchronous network model than ABD networks. 

For anonymous, unidirectional ABE rings of known ring size n, we devise a prob- 
abilistic leader election algorithm with average message complexity 0(n); see Sec. 3. 
Previously, leader election algorithms with linear time and message complexity have 
only been known for network models with a strict bound on the message delay, i.e., 
synchronous networks and ABD networks. In Sec. 4 and 5, we prove the correctness, 
the average linear complexity of our algorithm, followed by an optimisation of the ac- 
tivation parameter. The correctness proof and the complexity analysis are supported by 
an automated analysis with the probabilistic model checker PRISM in Sec. 6. 
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2 Asynchronous Bounded Expected Delay Networks 



We introduce the model of ABE networks, which strengthens asynchronous networks 
with the assumption of a known bound on the expected message delay. This strength- 
ening allows one to analyse the (average) time complexity of algorithms. 

At first glance it may appear superfluous to consider a bound on the expected delay, 
instead of the expected delay itself. We briefly motivate our choice. First, when deter- 
mining the expected delay for real-world networks, one needs to take into account pa- 
rameters such as material properties, environmental radiation, electromagnetic waves, 
etc. Frequently, these values change over time, or cannot be calculated precisely. Thus 
we have to cope with ranges for each of these parameters, and consequently, the best 
we can deduce is an upper bound on the expected message delay. Second, the links in a 
network are typically not homogeneous and often have different expected delays. Then 
the maximum of these delays can be chosen as an upper bound, instead of having to 
deal with different delays for ever link. 

Definition 1. We call a network asynchronous bounded expected delay (ABE) if the 
following holds: 

1 . A bound 8 on the expected message delay (network latency) is known. 

2. Let t be a real time. We assume that bounds < si ow < sugh on the speed of the 
local clocks are known. That is, for every node A the following holds for the local 
clock C A : s low ■ (t 2 - h) < \C A (t 2 ) - C A (ti)| < s Mgh ■ (t 2 - h) . 

3. A bound 7 on the expected time to process a local event is known. 

In comparison with ABD networks, the ABE network model relieves the assump- 
tion of a strict bound on the message delay. The assumption is weakened to a bound on 
the expected message delay. Thereby we obtain a probabilistic network model which, 
as discussed above, covers a wide range of real-world networks to which the ABD net- 
work model is not applicable. For this reason, we advocate the model of ABE networks 
as a natural and useful extension of the fully asynchronous network model. 

Example 1. The known upper bound on the expected message delay 8 allows for deriv- 
ing a lower bound p(t) on the probability that a message will be delivered with a delay 
less or equal to t. From 8 > t ■ (1 — p(t)) it follows that p(t) > 1 — S/t for t > 8. If 
8=1, then p(2) = 0.5, p(5) = 0.8, etc. As a consequence we also obtain that long 
message delays are less probable (but possible). 

To conclude this section, we discuss synchronisers for ABE networks. A synchro- 
niser is an algorithm to simulate a synchronous network on another network model. 
A well-known impossibility result [19] states that fully asynchronous networks cannot 
be synchronised with fewer than n messages per round (every node needs to send a 
message every round). This of course destroys the message complexity when running 
synchronous algorithms in a fully asynchronous network. The more efficient ABD syn- 
chroniser by Tel et al. [20] relies on knowledge of the bounded message delay. As in 
fully asynchronous networks the message delay in ABE networks is unbounded (al- 
though we assume a bound on the expected delay). In a slogan: every execution of a 
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fully asynchronous network is also an execution of an ABE network. The difference is 
that huge message delays in ABE networks are less probable. Hence, the impossibility 
result [19] for fully asynchronous networks carries over to ABE networks as follows: 

Corollary 1. ABE networks of size n cannot be synchronised with fewer than n mes- 
sages per round. □ 

Hence, we cannot run synchronous algorithms in ABE networks without losing 
the message complexity. Although ABE networks are very close to fully asynchronous 
networks, it turns out the model allows for the development of efficient algorithms. We 
show this at the example of a surprisingly robust and efficient leader election algorithm 
with 0(n) average time and message complexity. 



3 Fast Leader Election with Bounded Expected Delay 

We present a leader election algorithm for anonymous, unidirectional ABE rings. The 
algorithm is parameterised by a base activation parameter Ao 6 (0,1). The order of 
messages is arbitrary between any pair of nodes. For simplicity, we assume that the 
expected time to process a local event is 0, that is, 7 = 0. However, all results presented 
in this paper can be generalised straightforwardly for expected value 7 > 0. 

The algorithm presented below actually does not require continuous clocks. It suf- 
fices that every node has a local timer ticking once per (local) time unit. Obviously such 
a discrete timer can be simulated using continuous clocks, thus, w.l.o.g. we assume that 
every node has a timer in the sequel. 

During execution of the algorithm every node is in one of the following states: idle, 
active, passive or leader; in the initial configuration all nodes are idle. Moreover, every 
node A stores a number d(A), initially 1. The messages sent between the nodes are of 
the form (hop), where hop e {1, . . . , n} is the hop-counter of the message. Every node 
A executes the following algorithm: 

- If A is idle, then at every clock tick, with probability 1 — (1 — Ao) di - A \ A becomes 
active, and in this case sends the message (1). 

- If A receives a message (hop), it sets d(A) = max.{d{A), hop). In addition, de- 
pending on its current state, the following actions are taken: 

(i) If A is idle, then it becomes passive and sends the message (d(A) + 1). 

(ii) If A is passive, then it sends the message (d(A) + 1). 

(iii) If A is active, then it becomes leader if hop = n, and otherwise it becomes 
idle, purging the message in both cases. 

In other words, messages travel along the ring and 'knock out' all idle nodes on 
their way. That is, idle and passive nodes forward messages; by forwarding a message, 
idle nodes are turned passive. If a message has knocked out an idle node (at any point 
during its lifetime), we refer to the message as knockout message. If a message hits an 
active node, then it is purged, and the active node becomes idle, or is elected leader if 
hop = n (that is, if the node itself is originator of the message). We say that a node has 
woken up when it transits from the idle to the active state. 
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The value d(A) stores the highest received hop-count for every node. It indicates 
that d(A) — 1 predecessors are passive. A higher value of d{A) increases the probability 
that a node A becomes active. By taking 1 — (1 — Aa) dt " A ^ as wake-up probability for 
nodes A, we achieve that the overall wake-up probability for all nodes stays constant 
over time. This ensures that the algorithm has linear time and message complexity. 

Note that we forward messages (hop) as (d(A) + 1) instead of (hop + 1). This is 
used since the channels exhibit non-FIFO behaviour. Consider the following scenario. 
A message (h) with high hop-count overtakes a message (£} with low hop-count, and 
then (h) is purged by an active node A. Then d(A) — h and when {£) passes by A 
its hop-count will be increased to h + 1 (as if the overtaking would never have taken 
place). Using (hop + 1) instead of (d(A) + 1), there exist scenarios where all nodes are 
passive except for one idle node B, and d{B) = 2. That is, d{B) is much lower than the 
actual number of passive predecessors of B, and as a consequence the overall wake-up 
probability would not stay constant over time. 

We briefly elaborate on why the framework of ABE networks is essential for this 
leader election algorithm. The bound on the expected delay is necessary for proving that 
the algorithm terminates with probability one, and that the average time and message 
complexity are 0(n). To the best of our knowledge, the algorithm is the first leader 
algorithm with the linear average time and message complexity in the settings of asyn- 
chronous anonymous rings without a fixed bound on the message delay. 

4 Correctness 

Our leader election algorithm has terminated when all nodes are either passive or leader, 
and no messages are in transit. In this section we show that our leader election algorithm 
terminates with probability 1, and upon termination always exactly one leader has been 
elected. Our algorithm satisfies the following invariants: 

Lemma 1. For every node A at least d{A) — 1 predecessors are passive. 

Proof. Initially, the claim holds since d(A) = 1. Assume the claim would be wrong, 
then consider the first event invalidating the claim. By definition of the algorithm, d( A) 
is the maximum hop-count of all messages received by A, and passive nodes stay 
passive forever. Therefore, we can restrict attention to the case that a node A receives 
a message (x), but fewer than x — 1 predecessors of A are passive. The message (x) 
must have been sent by the predecessor B of A. The case of B being non-passive is 
trivial, since then it must have sent the message (1). If B is passive, then x < d(B) + 1, 
and since the invariant holds for B, d(B) — 1 predecessors of B are passive. Then 
d(B) = x — 1 predecessors of A are passive. □ 

Lemma 2. When a leader node is elected, all other nodes are passive. 

Proof. According to the algorithm, an active node A is elected leader, when it receives 
the message (n) . Then d(A) = n, so by Lemma 1 , all n — 1 other nodes are passive. □ 

Lemma 3. There are always as many messages in the ring as active nodes. 
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Proof. Initially all nodes are idle and the lemma holds. Let us consider all possible 
scenarios. If an idle or passive node receives a message (hop), it will relay the message 
further. Thus, the number of messages and active nodes remains unchanged. If an active 
node receives a message, it changes its state to either idle or leader. In both cases, the 
message is purged. Thus, both messages and active nodes decrease by 1. If an idle node 
becomes active, it sends out a message. Thus, the number of messages and the number 
of active nodes both increase by 1. Finally, note that when an active node receives the 
message (n), and becomes leader, by Lemma 2, all other nodes are passive, so that there 
are no other messages in the ring. Hence, in all cases the invariant is preserved. □ 

Lemma 4. Always at least one node is not passive. 

Proof. Only idle nodes A can become passive, after receiving a message (hop). This 
message will be passed on as (d(A) + 1). Hence, there is at least one message travelling 
in the network, and, by Lemma 3, at least one active node in the network. □ 

Using these four invariants, we can show that our algorithm is correct. 

Theorem 1. Upon termination, exactly one leader has been elected. 

Proof. Termination without elected leader is not possible, since by Lemma 4, there is 
always a non-passive node A (if A would be active there would be a message travelling 
by Lemma 3). By Lemma 2, if a leader has been elected, all other nodes are passive. 
Hence, upon termination there is a unique leader. □ 

Theorem 2. The leader election algorithm terminates with probability one. 

Proof. There exist only a finite number of network configurations C. For every non- 
terminated configuration c e C, there is a probability P(c) > such that for every 
possible non-deterministic choice the probability of the next scenario is at least P(c): 

- no idle node becomes active until all messages in the network are forwarded and 
received by active nodes (by Lemma 3 there are as many messages as active nodes 
in the network); 

- next, exactly one idle node A (which exists by Lemma 4) becomes active, and its 
message travels around the whole ring without any other node becoming active. 
When A receives its own message, it is elected leader and we have termination. 

Taking ( = min{P(c) | c G C} we obtain that from every possible non-terminated 
configuration the probability of termination is at least £ > 0. Hence the algorithm 
terminates with probability one. □ 

5 Complexity 

In this section, we show that our algorithm has linear time and message complexity. 
First, we give an intuition behind the linear complexity of the algorithm. The crux is 
the choice of a suitable activation parameter Ao(n). To achieve a linear complexity it 
suffices to take (the non-optimal) Ao{n) = 1- \]{n - l)/(n + 1). We briefly elaborate 
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on this choice. For simplicity we assume si ow = Sh %g h = 1 and 5 = 1 for this sketch. 
If all nodes gamble once, the probability that any of the nodes wakes up is 1 — (1 — 
Ao{n)) n = 2/(n + 1). The bound 5 on the expected message delay allows us to derive 
a bound R(n) on the expected time for a message to travel through the whole ring: 
R(n) = 5 -n = n. Then the probability W(n) of any node waking up during R(n) time 
is 1 — (1 - 2/(n + 1))" which converges to: W(n) — > 1 - e~ 2 , for n -> oo. This is 
the crucial observation yielding linear time and message complexity: the time R(n) for 
a round trip of a message is linear in n, and the probability W(n) of any node waking 
up during this time is constant (i.e. asymptotically independent of n). 

Omitting the simplification si ow = s^igh = S = 1, we have R(n) = 5 ■ n = n, and 
we employ the lower (upper) bound si ow (Shigh) on the clock speed to derive a lower 
(upper) bound on the probability of any node waking up during the time. 

For every node A we define the activation count w(A) as the number of times this 
node has woken up. We now show the properties of the activation count. 

Lemma 5. Let A and B be active or idle nodes such that the path from A to B visits 
only passive nodes. Then the number of messages between A and B is 

w(A) - w(B) + active(B) 
where active(i?) is 1 if B is active, and otherwise. 

Proof. Initially all nodes are idle and the lemma holds. That is, active(B) = 0; more- 
over, w(A) = w(B) = and there are no messages in the ring. For a node A we 
denote p(A) and s(A) as the first active or idle predecessor and successor of A, respec- 
tively. First, consider the case: A = B. Then all nodes except for A are passive, and by 
Lemma 3 there is a message in the ring iff A is active. For the remainder of the proof 
we assume A ^ B, that is, A ^ s(A) and A ^ p(A). Let us consider all possible 
events. 

If a passive node receives a message (hop), it relays the message further. Thus, the 
number of messages between active or idle nodes remains unchanged. 

If an idle node A receives a message (hop), it becomes passive and relays the mes- 
sage further. Then, the number of messages between p(A) and s(A) is: 

(w(p(A))-w(A)+0)+(w(A)-w(s(A))+act\\/e(s(A))) = w(p(A))-w(s(A))+act\ve(s(Aj) 

If an idle node A becomes active, it sends out a message. The same holds for the 
number of messages between A and s(A). Then w(A), and so w(A) — w(s(A)) + 
act\ve(s(A)), increases by 1. The number of messages between p(A) and A remains 
unchanged: w(p(A)) — w(A) + active(A), both w(A) and active(A) increase by 1 and 
thereby equal each other out. 

Finally, if an active node A receives a message, it changes its state to either idle or 
leader. In both cases, the message is purged. The number of messages between A and 
s(A) remains unchanged: w(A) — w(s(A)) + active(s(A)). The number of messages 
between p(A) and A decreases by 1. The same holds for w(p(A)) — w(A) + active(A), 
since active(A) decreases by 1. Hence, in all cases the lemma holds. □ 

Lemma 6. Let A and B be nodes such that A is not passive, the path from A to B visits 
only passive nodes, and there are no knockout messages between A and B. Then the 
number of nodes between A and B (not counting Bj is d(B) — 1. (Note, if A = B, we 
assume the path around the whole ring) 
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Proof. Let p(C) be the number of passive predecessors of C (not counting C). We say 
that a node C is informed if d{C) — 1 = p(C). Likewise, a message M with hop-count 
/i is called informed if exactly h — 1 nodes preceding M are passive. 

We prove by induction over the number of events: for all nodes A and B such that A 
is not passive, and the path from A to B visits only passive nodes, either B is informed, 
or there is an informed knockout message between A and B. By Lemma 1 we have 
d(B) — 1 < p(B). Initially all nodes are informed. We consider all possible events. 
If an informed (knockout) message is relayed by a passive node, the message stays 
informed and the node becomes informed. 

If a message knocks out an id le node A, then either the node was informed and hence 
sends out an informed knockout message, or (by induction hypothesis) there must be 
an informed knockout message M before A. In the latter case, if M was the message 
received, then the node becomes informed. 

If an active node A purges an informed knockout message, it becomes informed. 

Finally, if an idle node A becomes active, it sends out a (non-knockout) message. 

Hence, in all cases the lemma holds. 

As a direct consequence we obtain the following corollary stating that the overall 
wakeup probability of all nodes in the ring stays basically constant. 

Corollary 2. Whenever there are no knockout messages travelling in the ring, 
1 - (1 - Ao) n = 1 - [] (1 - A ) d{A) 

A is idle or leader 

Proof. There are two possible scenarios, where no knockout messages travel in the ring; 
(i) there are only idle and passive nodes, or (ii) node A is leader and the other n — 1 
nodes are passive. Then we can divide the ring in chains of passive nodes followed by 
an idle or leader node A, and by Lemma 6 we have d(A) is the length of the chain plus 
1. As a consequence we obtain: J2a is idle or leader d ( A ) = n - 

In other words, the overall wakeup probability (for idle and active nodes) may only 
decrease as long as a knockout message travels through the ring. This means that there 
is a message in the ring that has turned nodes from idle to passive and did not yet 
encounter an active node (and hence did not complete a round trip). As soon as this 
message is purged by an active node A, the node updates its counter d(A) representing 
the number of passive predecessors, thereby restoring the overall wakeup probability. 

Lemma 7. If an active node A with activation count w{A) receives a message while 
all other nodes have activation count smaller than w{A), then A is elected as leader. 

Proof. Assume, towards a contradiction, that there are at least two idle or passive nodes 
in the ring. By Lemma 5 there are no messages between A and its first active or idle 
predecessor, unequal to A. Hence, A can receive a message only if all other nodes are 
passive. By Lemma 6 it follows that after A received this message, d{A) — 1 = n — 1. 
Hence A must have received the message (n), and thus is elected leader. 

Theorem 3. The election algorithm has linear time and message complexity. 
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Proof. First, we prove the linear time complexity. Recall that the timer of every node 
ticks ones per unit of local time. Thus, within 1 / si ow global time the timer of every node 
ticks at least once. By Lemma 2, 1 — (1 — Ao) n is a lower bound on the probability for 
at least one node waking up in l/si ow time. Hence, an upper bound F on the expected 
time until the first node becomes active can be obtained as follows: 

oo 

'-^•B'+^-^-e-i'-Ar)- — -irjr^ 

The expected time for a message to travel around the entire ring is R = n ■ S. An 
upper bound W on the probability of any node waking up during R time is W = 
1 - (1 -Ao) n ' R ' Shi!lh . 

The first node A gets active after expected time F. Then with probability 1 — W 
no other nodes wakes up while the message of A travels around the ring, and in this 
case, after expected time R the node A will be elected as leader. With probability < W 
another node wakes up while the message of A makes a round trip. Then after expected 
time R all non-passive nodes in the ring will have activation count at least one. This 
can be seen as follows. The message of A travels along the ring, knocking out all nodes 
with activation count < w(A), until it is purged by an active node B. Then B must 
have become active after A, and itself sent out a message. We continue with tracing this 
message of B, and successively apply the same reasoning until we have finished one 
round trip, and are back to A. 

In case another node has woken up while the message of A was travelling around the 
ring, the described scenario repeats. For this it is important to observe that by Lemma 2 
the overall wakeup probability of all nodes stays constant. As a consequence, after 
expected time F a node B will wake up, and get the highest activation count w(B). 
By Lemma 7, after expected time R either (i) B will be elected leader (probability 
1 — W), or (ii) all non-passive nodes in the network have at least activation count w(B) 
(probability W). This leads to the upper bound on the expected time of termination 

VVj + i) . (F + R) ■ W i ■ (1 - W) = 1 + - ' Slow - (1 ~ ' - ' Slow (1) 

For Ao we choose the following expression depending on n: Aq = 1 — \J^p[- Using 
this activation parameter time complexity is linear with respect to the ring size n. The 
derivation of this parameter will be explained in the next subsection. Substituting the 
expression for Ao into (1), we obtain: 

^ + (l-(l-AoT)-n-6 -i- + -2 T . n . g ^- n -^ + nA 

(1 - (1 - Ao) n ) ■ (1 - A ) n2 - S - S ^ ■ (^TT) n ' 5 " Sh ' 9h (Stt)"' 5 "'"" 1 

Noting that lim„^ 00 (^i)™ ,5 ;s '"<>< 1 = (4 r ) <5 s '"'<\ we obtain that the time complexity 
(i.e. the expression above) is 0(n). 

Now, we prove the linear message complexity. Since the time complexity is linear, 
here is £ > such that the average execution time of the algorithm < £ • n. A lower 
bound on the expected time until a node becomes active is: Fi ow — -A-^ ■ 1 _^ Aq ^ ■ 
Thus, the expected number of nodes "waking up" during the algorithm execution is 
- ife = £ ■ n ■ Shi a h • ( X _ C 1 _ A o) n ) = £ • s high ■ ^pr- Since every "wake up" 
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gives rise to at most n messages (once around the ring) and by the expression above, 
the algorithm has linear message complexity. 



The concept of message complexity differs from bit complexity. The message com- 
plexity refers to the expected number of messages until termination, while bit complex- 
ity is the total number of bits transmitted. Our algorithms has 0{n) message complexity, 
and 0(n ■ log n) bit complexity as the messages are log n in size. 

Optimal Value for Ao The crux of the algorithm is the activation parameter Ao influ- 
encing both the time and message complexity. We optimise Ao with respect to time 
complexity in dependence on the network size n. For simplicity we assume 5 = 1, 
Slow = Shigh = !■ We conclude this section with a discussion of the general case. 

The value for Ao (depending on n) derived from the optimisation is applied in the 
proof of Theorem 3. This shows that the obtained activation parameter results in linear 
time and message complexity for arbitrary values for 6, si ow and s^gh, although the 
analysis does not take these values into account. 

For the purpose of optimisation, we consider average-case scenarios instead of 
worst-case scenarios as used in the proof of linear time and message complexity (The- 
orem 3). Let a = 1 — Ao- Then, the average number of attempts before a first node 
becomes active is 

oo 

(1 - a n ) ■ 1 + (1 - a n ) ■ a n ■ 2 + . . . - (1 - a n ) ■ • (i + 1) = j—^ 

i=0 

The probability /3 that a message of this first node completes its round-trip is a" -1 • 
a"~ 2 ■ .. . ■ a = a" (n 2 r> . since the expected time for a round-trip is n ■ 8 — n. Note 
that in the proof of Theorem 3 we have used an upper bound on the worst case for (3, 
namely a n . 

Thus, the average time required to elect a leader is 

• r^r + (i - /*) • ■ + {^-Pf-P- + ■■■= R J nV 

1 - a n 1 — a n 1 - a n p ■ (1 — a n j 

We take (1 — j3) as the probability of fail trial for the message to make a round-trip. We 
now derive an optimal value for Ao- Optimal here means that the average time to elect 
the leader is as low as possible. That is, we minimise ^ ^ 1 ^ a „- ) by taking the derivative: 



(n - 1) • a3«("-i) _ („ + 1) . a hn(n+i) = Q ^ ^ = i_ 



1 



+ 1 

Note that for a large ring size n, the optimal activation parameter Ao converges to 

1 - i/X- 

We also simulated our algorithm in a round-based fashion, taking one global time 
unit as a measure of a round. Fig. 1 shows two set of experiments (based on 5000 
independent runs for each point of each curve). The left graph of Fig. 1 illustrates the 
impact of the activation parameter (x-axis) on the time and message complexity for a 
network with 100 nodes. The experiment confirms the analytical derived optimal value 
for the activation parameter Ao ~ 0.0002 for n = 100. 
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Fig. 1. The different activation parameters Ao for 100 nodes (left). The optimal activation param- 
eter for various ring size (right). 



For the second set of experiments, we used the analytically derived optimal activa- 
tion parameter. The right graph in Fig. 1 shows the total number of messages and time 
units for the network size up to 620 nodes. We can see that our experimental results 
confirm the linear time and message complexity for the optimal activation parameter 
Ao depending on the network size n. 

We conclude this section with a brief discussion of the general case for arbitrary S, 
si ow and Shigh- As already mentioned, Ao = 1 — \J (n — 1 ) / (n + 1 ) results in linear 
time and message complexity for arbitrary values of these parameters. However, the 
constant factor in 0(n) can be high when optimising for the wrong parameters. Note 
that, for the case si ow < Shigh we cannot speak about 'the' optimal value for Ao since 
we don't know the exact speed of every local clock. However, we can optimise for the 
worst-case scenario, then every real-world instance will only perform better. That is, 
to compute the average number of attempts before a first node becomes active we use 
si ow (slower ticking clocks imply lower wake-up probability), and for probability of a 
message to complete its round-trip f3 we use Shigh (faster ticking clocks imply worse 
probability) in combination with i5 (expected time for a round-trip is n ■ S). 



6 Automatic Analysis 

To support the correctness proof and complexity analysis, we modelled our algorithm 
in the probabilistic model checker PRISM [21]. The properties like "eventually exactly 
one leader is elected" are expressed in the probabilistic temporal logic PCTL [22,23]. 
The algorithm is modelled in PRISM's state-based input language. Each process and 
each non-FIFO message channel is modelled as a module. The message channels have 
the same size n as the ring network. One global variable A is used for the activation 
probability. The PRISM models and the properties in PCTL can be found at 
http : / / www . f ew . vu . nl/~rbakhsfii/alg/ onprism . tar . gz. 

For the model checking, we used PRISM (version 3.3). The option "Use fairness" 
is turned on to restrict model checking only to fair paths. In PRISM fairness is defined 
as follows: a path (in a computation tree) is fair if and only if for all states occurring 
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Fig. 2. Model checking results in PRISM 



infinitely often on the path, each non-deterministic choice is taken infinitely often [24]. 
It excludes infinite executions of the algorithm having probability 0.0. The other pa- 
rameters in PRISM remain at default setting. 



Correctness To verify the correctness, the algorithm is modelled as a Markov decision 
process, allowing both non-deterministic and probabilistic behaviour. In our experi- 
ments, we ask PRISM to compute the minimum probability that eventually exactly one 
leader is elected. Fig. 2 (left) summarises our model checking results. The first columns 
in Fig. 2 (left) give the ring size n and the number of states and transitions of the model. 
The second part shows the parameter A and the computed minimum probability for 
eventually electing a unique leader. The minimum probabilities in all experiments are 
1.0, which proves the correctness of the algorithm up to ring size seven. 



Performance Analysis To compute the average-case complexity, the algorithm is mod- 
elled as a discrete-time Markov chain. For the first set of experiments, we used PRISM 
to compute the expected time to elect a leader for a fixed activation probability Aq for 
n = 6. That is, the probability that exactly one leader has been elected in the past 
time units steps (see Fig. 2, the right graph). The results correspond to our theoretical 
findings, namely, for n = 6, the optimal value for the activation parameter is rs 0.0545. 
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